Vault Enterprise Multiple Select — 20 Questions

Question 1

A Vault Enterprise administrator is configuring a new cluster with Integrated Storage and wants to enable TLS for secure communication. The administrator has obtained a server certificate, a private key, and a CA certificate. Which TWO configuration parameters must be set in the listener stanza to enable TLS? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

tls_key_file. To enable TLS in a Vault listener stanza, you must provide the server certificate and its corresponding private key using tls_cert_file and tls_key_file. These are the only required parameters for TLS. The CA file is only needed for client certificate verification, and tls_min_version is optional. The other options are either not required or invalid parameter names.

Answer

tls_client_ca_file

Answer

tls_min_version

Answer

tls_ca_file

Question 2

Which TWO of the following are true about AppRole 'SecretID' management?

Accepted Answer

SecretIDs can be constrained by 'num_uses'.. Option B is correct because a SecretID can be created with a 'num_uses' constraint, meaning it is invalidated after a set number of authentication uses, which limits the blast radius if the SecretID leaks. Option D is correct because SecretIDs are issued with a TTL (via 'secret_id_ttl' on the role or an explicit TTL at generation), after which they expire and can no longer be used to authenticate. Option A is wrong because RoleID and SecretID are distinct AppRole credentials: the RoleID identifies the role and is not secret, while the SecretID is the sensitive half of the pair. Option C is wrong because SecretIDs are sensitive credentials and must never be committed in cleartext to version control. Option E is wrong because each SecretID is uniquely generated per application/instance, not shared across all applications in a namespace.

Answer

SecretIDs are synonymous with RoleIDs.

Answer

SecretIDs should be stored in cleartext in version control.

Answer

SecretIDs are the same for all applications in a namespace.

Question 3

Which TWO of the following are potential causes for a 'PKCS#11 error' during Vault operation?

Accepted Answer

Incompatibility between the library version and the HSM firmware.. Option A is correct because Vault's PKCS#11 auto-unseal and HSM integrations load a vendor PKCS#11 library (e.g., libCryptoki2.so) to talk to the HSM, and a mismatch between that library version and the HSM's firmware can cause the C_* calls to fail, surfacing as a 'PKCS#11 error'. Option B is correct because the PKCS#11 session login uses the HSM's user PIN (C_Login with CKU_USER); an incorrect or expired PIN makes authentication fail and Vault reports a PKCS#11 error. Option C is not a PKCS#11 cause: an expired Vault token produces a Vault API 'permission denied' or token-expired error, unrelated to the HSM's PKCS#11 interface. Option D is unrelated because a full storage backend causes write failures in Vault's storage layer, not a PKCS#11 cryptographic error. Option E is unrelated because a local firewall blocking network traffic would typically manifest as connection timeouts or refused connections, not a PKCS#11 library-level error.

Answer

The Vault token has expired.

Answer

The storage backend is full.

Answer

The network is blocked by a local firewall.

Question 4

Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?

Accepted Answer

Sentinel policies support EGP and RGP types.. Option D is correct because Vault Enterprise Sentinel policies come in two enforcement types: Endpoint Governing Policies (EGP), which are attached to specific paths and evaluated on requests to those endpoints, and Role Governing Policies (RGP), which are attached to tokens/roles and evaluated based on the identity making the request. Option E is correct because Sentinel is a full policy-as-code language with constructs like rules, functions, conditionals, and imports, allowing administrators to encode rich, context-aware business logic (for example, requiring MFA, time-of-day restrictions, or specific metadata) that goes well beyond simple path-based allow/deny. Option A is not correct because Sentinel policies are written in Sentinel, a purpose-built language, not HCL (HCL is used for Vault ACL policies and configuration). Option B is not correct because Sentinel does not replace ACLs; ACLs remain the primary authorization mechanism and Sentinel adds an additional layer of control. Option C is not correct because Sentinel policies are evaluated after ACLs, not before — a request must first pass the ACL check before Sentinel policies are applied.

Answer

Sentinel policies are written in HCL.

Answer

Sentinel policies replace ACLs.

Answer

Sentinel policies are evaluated before ACLs.

Question 5

Which THREE actions can the 'change_mode' parameter trigger in the Vault Agent template block?

Accepted Answer

signal. In the Vault Agent template stanza, the change_mode parameter controls what happens when the rendered secret changes, and its valid values are signal, restart, and noop. Option A (signal) is correct because it sends the configured signal (default SIGHUP, or the value of signal) to the process specified by the exec block, allowing the application to reload its configuration without a full restart. Option B (restart) is correct because it instructs Vault Agent to stop and restart the child process defined in the exec block so it picks up the new secret. Option D (noop) is correct because it tells Vault Agent to take no action on the process when the template output changes, leaving the application to detect the change itself. Option C (delete) is not a valid change_mode value; Vault Agent does not delete the process or file as a change action. Option E (exec) is also not a valid change_mode value; exec is a separate template stanza block that defines the command to run, not a change-triggered action.

Answer

delete

Answer

exec

Question 6

Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?

Accepted Answer

Performance Replication.. Performance Replication (B) is a Vault Enterprise-only feature that lets a cluster serve read-heavy workloads across multiple secondary clusters while writes are forwarded to the primary, and it is configured at the server level via the replication stanza and related server settings. HSM Seal Wrapping (D) is also Enterprise-only and directly tied to server configuration: it uses an HSM to wrap the root key so that unsealing can be performed automatically via the seal "pkcs11" stanza in the Vault server configuration. Audit logging (A), KV Secret Engine (C), and Token management (E) are all core Vault capabilities available in the open-source edition and are not Enterprise-specific server-configuration features, so they do not fit the scenario.

Answer

Audit logging.

Answer

KV Secret Engine.

Answer

Token management.

Question 7

Which THREE of the following are common troubleshooting steps when Vault fails to unseal via HSM?

Accepted Answer

Check Vault logs for specific PKCS#11 error codes.. Option B is correct because when Vault fails to unseal via HSM, the Vault server logs typically surface PKCS#11 error codes (e.g., CKR_SLOT_ID_INVALID, CKR_TOKEN_NOT_PRESENT) that pinpoint whether the failure is a slot, token, PIN, or session issue, making log inspection a standard first troubleshooting step. Option D is correct because Vault's seal stanza requires a valid path to the HSM vendor's PKCS#11 library (e.g., /usr/lib/libpkcs11.so or /opt/vendor/lib/libpkcs11.so); if that path is wrong, missing, or unreadable by the vault user, Vault cannot load the library and unsealing fails. Option E is correct because using the HSM vendor's own CLI tools (e.g., pkcs11-tool --list-slots or the vendor utility) confirms the slot/token is present, initialized, and accessible outside Vault, isolating whether the problem is in the HSM itself versus Vault's configuration. Option A is not a troubleshooting step for HSM unsealing failures because 'vault operator unseal' is the normal unseal operation itself, not a diagnostic action, and it will simply fail again if the underlying PKCS#11 issue is unresolved. Option C is incorrect because the storage backend driver is unrelated to HSM-based auto-unseal; upgrading it would not address PKCS#11 library, slot, or token problems.

Answer

Run 'vault operator unseal' manually.

Answer

Upgrade the storage backend driver.

Question 8

Which THREE conditions might result in a Vault node becoming unhealthy?

Accepted Answer

Storage backend connection failure.. Option A is correct because Vault's health status depends on its storage backend; if Vault cannot reach or use its configured storage (e.g., Consul, Raft, file, or cloud storage), it cannot serve requests and reports unhealthy. Option B is correct because a sealed Vault node has no access to its master key or unseal keys, so it cannot decrypt the barrier or serve secrets, and its health endpoint returns a sealed, unhealthy status. Option D is correct because a non-leader node that cannot reach the active cluster leader cannot forward requests or participate properly in the cluster, causing it to report unhealthy. Option C is not correct because telemetry endpoints (such as Prometheus or StatsD sinks) are optional observability outputs; their failure does not affect Vault's core health status. Option E is not correct because audit log devices are configured sinks, and while audit failures can block requests, 'audit logs are full' is not a standard Vault health condition and does not by itself make the node unhealthy.

Answer

Telemetry endpoint is down.

Answer

Audit logs are full.

Question 9

Which TWO of the following are true regarding the Vault Kubernetes Auth Method 'bound_service_account_names' parameter?

Accepted Answer

It allows wildcards to match multiple service accounts.. Option B is correct because the Vault Kubernetes Auth Method's bound_service_account_names parameter accepts glob-style wildcards (for example, 'app-*') so a single role can match multiple service account names. Option D is correct because this parameter defines the allowlist of Kubernetes service account names permitted to authenticate against that Vault role, so any service account not listed is rejected. Option A is wrong because the parameter has nothing to do with cluster-admin privileges; it merely constrains service account identities and works with any service account. Option C is wrong because Vault policies are still required to define the actual permissions granted after authentication; bound_service_account_names only governs who may log in. Option E is wrong because bound_service_account_names is a required parameter for the Kubernetes auth role, not something that becomes optional when bound_namespaces is configured.

Answer

It can only be applied to cluster-admin accounts.

Answer

It replaces the need for Vault policies.

Answer

It is optional if 'bound_namespaces' is set.

Question 10

Which THREE actions are permitted by the 'vault operator' command group?

Accepted Answer

Rekey the master key.. Option A is correct because 'vault operator rekey' is part of the operator command group and is used to generate a new master key (or recovery key) by re-entering the required threshold of unseal/recovery keys. Option C is correct because 'vault operator step-down' forces the active Vault node to give up its active status and trigger a leader election, which is an operator-level cluster management action. Option D is correct because 'vault operator unseal' submits an unseal key share to progress the Vault server out of its sealed state, a core operator responsibility. Option B does not belong because creating a user login is an authentication/userpass operation (e.g., 'vault write auth/userpass/users/...'), not an operator command. Option E does not belong because enabling a new secrets engine is done with 'vault secrets enable' (or the sys/mounts API), which is not part of the operator command group.

Answer

Create a user login.

Answer

Create a new secret engine.

Question 11

Which TWO statements are true about the relationship between Performance Standby nodes and Performance Replication?

Accepted Answer

Performance Standby allows read scaling within a single cluster.. Option C is correct because Performance Standby nodes in Vault are read-only replicas within the same cluster that serve read requests, thereby enabling read scaling within a single cluster. Option D is correct because Performance Replication and Performance Standby are complementary features that can coexist on the same cluster, allowing both cross-cluster replication and intra-cluster read scaling. Option A is incorrect because Performance Replication and Performance Standby are distinct features, not a subtype relationship. Option B is incorrect because Performance Replication does not require Performance Standby nodes; replication can function without them. Option E is incorrect because replication does not require performance standby nodes for all nodes.

Answer

Performance Replication is a type of Performance Standby.

Answer

Performance Standby nodes are required for Performance Replication.

Answer

Replication requires performance standby for all nodes.

Question 12

Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?

Accepted Answer

The KMS Key ID or ARN.. To enable Auto-Unseal with a cloud KMS, Vault must know which key to use, so option B (the KMS Key ID or ARN) is required to identify the specific KMS key that Vault will call for encryption/decryption operations. Option C (a cloud provider IAM role with decrypt permissions) is also required because Vault's identity must be authorized by the cloud provider to invoke the KMS Decrypt (and typically Encrypt) API; without those permissions the unseal call fails. Option E (a 'seal' stanza in the Vault configuration) is correct because Auto-Unseal is declared in the Vault config using a seal stanza (for example seal "awskms" or seal "azurekeyvault") that specifies the KMS provider and its parameters, which Vault reads at startup. Option A is not required, since Auto-Unseal works on a single Vault node and does not mandate a 5-node cluster (that relates to integrated storage quorum, not KMS unsealing). Option D is incorrect because a local unseal key file is the manual Shamir unseal mechanism, which Auto-Unseal is specifically designed to replace.

Answer

A cluster of at least 5 nodes.

Answer

A local unseal key file.

Question 13

Which THREE components are involved in a standard high availability (HA) Vault architecture?

Accepted Answer

A load balancer.. In a standard HA Vault architecture, a load balancer (A) is required to distribute client requests across the active and standby nodes, routing traffic to the current leader and providing a stable endpoint. Multiple Vault nodes (D) are essential because HA relies on a cluster of Vault servers where one node is active and the others are standbys ready to take over via leader election. A storage backend such as Raft or Consul (E) is also required, since it provides the shared, highly available data store that all nodes use for configuration, state, and leader election coordination. A secondary Vault cluster (B) is not part of a standard HA setup; it describes disaster recovery replication (performance or DR replication) rather than HA within a single cluster. An external monitoring tool (C) is useful for observability and alerting but is not a required architectural component of Vault's HA design.

Answer

A secondary Vault cluster.

Answer

An external monitoring tool.

Question 14

Which THREE factors influence the performance of a Performance Secondary cluster?

Accepted Answer

The speed of the network between primary and secondary.. Option A is correct because a Performance Secondary receives replicated data from the Primary over the network, so the bandwidth and latency of the link between primary and secondary directly affect how quickly that replication is applied and how current the secondary's data is. Option B is correct because the secondary must persist and serve the replicated writes from its own storage backend, so disk IOPS, throughput, and latency on the secondary determine how fast it can apply and read that data. Option E is correct because the volume of write operations on the Primary drives the replication workload the secondary must process; a higher write rate increases the replication traffic and processing burden on the secondary. Option C is not correct because Performance Standby nodes are read-only replicas that scale read capacity on the Primary cluster and do not govern the performance of a Performance Secondary. Option D is not correct because root tokens are authentication credentials and have no bearing on cluster performance.

Answer

The number of Performance Standby nodes on the Primary cluster.

Answer

The number of root tokens in the system.

Question 15

Which THREE settings are critical to verify in the Vault configuration file to ensure successful cross-cluster communication?

Accepted Answer

api_addr. Option C (api_addr) is critical because it tells each Vault node the address clients and other clusters should use to reach its API, and an incorrect value breaks cross-cluster request routing. Option D (listener.tcp.address) is critical because the TCP listener must bind to an address reachable by the peer cluster (e.g., 0.0.0.0:8200 or the node's routable IP) rather than only loopback, otherwise incoming cross-cluster traffic cannot connect. Option E (cluster_addr) is critical because it advertises the node's address for cluster-to-cluster (Raft replication) traffic, and a wrong or unreachable value prevents nodes from joining and replicating across clusters. Option A (storage_type) is not a cross-cluster communication setting; it only selects the backend (e.g., raft, file, consul) and does not affect inter-node reachability. Option B (ui) merely enables or disables the web UI and has no bearing on cross-cluster communication.

Answer

storage_type

Answer

ui

Question 16

Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?

Accepted Answer

Use the Vault Agent injector for automatic sidecar management.. Option A is correct because the Vault Agent injector automatically manages the lifecycle of Vault tokens for pods, rendering secrets into a shared volume and renewing or re-authenticating tokens without exposing long-lived credentials to application code, which reduces the attack surface for token theft. Option B is correct because applying 'token_bound_cidrs' to the Kubernetes auth role restricts the issued token so it can only be used from specified CIDR ranges, meaning a stolen token is useless if replayed from an unauthorized network location. Option C is correct because setting short TTLs on all issued tokens limits the window of opportunity for an attacker who obtains a token, forcing frequent re-authentication and reducing the blast radius of a compromise. Option D is not recommended because disabling audit logging removes the ability to detect and investigate token theft or misuse, and audit logging is a core security control rather than an optional performance trade-off. Option E is not recommended because using the 'root' token for an application grants unrestricted, long-lived privileges across Vault, so any theft of that token results in total compromise rather than scoped access.

Answer

Disable audit logging to increase performance.

Answer

Use the 'root' token for the application.

Question 17

When designing a secure Vault-Kubernetes Auth integration, which THREE factors must be considered to prevent token compromise?

Accepted Answer

The scope of the service account token.. Option B is correct because the scope of the service account token determines what the Vault Kubernetes auth backend can validate and which namespaces, service accounts, and audiences are trusted; a broadly scoped or overly permissive token increases the blast radius if compromised. Option C is correct because Vault must validate the Kubernetes API server CA when calling the TokenReview API, ensuring it is communicating with the legitimate API server and preventing man-in-the-middle attacks that could forge token validation responses. Option E is correct because the TTL of the Vault token generated limits the window of exposure; shorter TTLs reduce the impact of a stolen Vault token and force periodic re-authentication. Option A is not relevant because the number of nodes in the cluster does not directly affect Vault-Kubernetes auth token compromise. Option D is not relevant because the Kubernetes binary version alone does not determine the security of the Vault auth integration, though supported versions matter for overall cluster security.

Answer

The number of nodes in the cluster.

Answer

The version of the Kubernetes binary.

Question 18

You are deploying a new Vault Enterprise cluster that will use a PKCS#11 HSM for auto-unseal. The HSM is a network-attached appliance reachable over TCP. Which TWO configuration elements must be present in the seal stanza to allow Vault to communicate with this HSM? (Choose two.)

Accepted Answer

The slot number or slot label that identifies the HSM partition.. To use a PKCS#11 HSM for auto-unseal, Vault needs the vendor's PKCS#11 library path and a way to select the correct slot or partition. These two elements allow Vault to load the library, initialize a session, and log in to the HSM. Other details such as management IP, serial number, or firmware version are not part of the seal stanza configuration.

Answer

The HSM's firmware version to ensure compatibility with Vault's PKCS#11 calls.

Answer

The HSM's serial number to bind the seal to a specific hardware unit.

Answer

The IP address and port of the HSM's management web interface.

Question 19

A Vault Enterprise administrator is reviewing the security of a new auth method that will be used by external partners. The partners will authenticate from their own networks and will receive tokens with a limited set of policies. The administrator wants to ensure that if a token is stolen, the blast radius is minimized. Which TWO controls should be applied to the auth role to reduce the impact of a stolen token? (Choose two.)

Accepted Answer

Set a short token TTL and a short max TTL on the role so that tokens expire quickly and cannot be renewed indefinitely.. Short TTLs and CIDR binding are complementary controls that reduce the usefulness of a stolen token. Short TTLs limit the time window, while CIDR binding limits the network locations from which the token can be used. Together they shrink the blast radius. Indefinite renewal, root policy, and disabling audit logging all increase risk and violate least privilege.

Answer

Enable the token to be renewed indefinitely so that partners do not need to re-authenticate frequently, reducing the chance of credential exposure during login.

Answer

Assign the root policy to the token so that administrators can quickly investigate and remediate any suspicious activity.

Answer

Disable audit logging for the auth method to prevent attackers from learning which policies are assigned to the token.

Question 20

You are configuring a Vault Enterprise cluster with integrated storage to scale for a high-read workload. You plan to add performance standby nodes. Which two statements accurately describe how performance standbys affect scaling and request handling? (Choose two.)

Accepted Answer

Performance standbys forward write requests to the active node, which then commits the change to the replicated data store.. Performance standbys scale read-heavy workloads by serving reads locally from the replicated data store, and they forward writes to the active node for commitment. They do not participate in Raft elections and cannot become active, which distinguishes them from standard standbys. These two characteristics make them ideal for read scaling without altering the write path or failover topology.

Answer

Performance standbys participate in the Raft quorum and can become the active node if the current active fails.

Answer

Performance standbys can accept write requests and commit them directly to the integrated storage backend.

Answer

Performance standbys require a separate integrated storage backend that is synchronized via performance replication.